METHOD OF AND APPARATUS FOR TRANSFERRING DATA 
BACKGROUND OF THE INVENTION 

[001] This invention relates generally to the transferring of data in a secure manner 
using an electronic encoding and decoding system. The invention finds particular 
application to the remote keyless control of entry systems although It is not limited to 
this application which is described hereinafter merely by way of example. 
[002] Electronic encoding and decoding systems are being used to an increasing 
extent in access control and other security systems. 

[003] When applied to the opening of a garage or other door a remote control offers 
a user the convenience of not having to leave a vehicle in order to operate the door 
opener. Remote keyless entry utilised in a vehicle allows the user easy access to a 
vehicle without fitting a key into a keyhole. Remote control transmitters offer a 
convenient mechanism to activate and deactivate security systems like alarms and 
can act as mobile panic buttons. 

[004] The capability of an attack on a security system increases as the power and 
speed of commercially available computers advance and as these devices become 
cheaper. In other words security levels for access control are dynamic by nature and 
must from time to time be adjusted. 
PRIOR ART 

[005] Early digitally based encoders and decoders were designed to transmit a fixed 
code of say 8 bits. The encoder (transmitter) would transmit the same code each 
time it was activated. 

[006] This type of system was attacked using a scanning device which includes a 
transmitter stepping through all of the codes sequentially. Since the number of 
possible codes was quite small, it was feasible to step through all the codes in a 



relatively short time. This type of scanning could be achieved by hand, using DIP- 
switches in an off-shelf transmitter. 

[007] To counter this problem the number of bits (code length) was increased and 
anti-scanning techniques were implemented. For example if a number of invalid 
codes were received in a short time period the system would freeze for a few 
minutes in order to make the time required to scan through the code space 
unacceptably long. 

[008] This solution was in turn defeated by code grabbers or recorders. The 
transmitted code was recorded and replayed. Irrespective of code length the 

receiver (decoder) was not able to distinguish between an original message and a 
recording thereof. A typical replay attack is impossible to prevent in a fixed code uni- 
directional system. 

[009] To overcome the code grabbing technique variable code, rolling code, or code 
hopping, systems were designed. These were all uni-directional systems because 
bi-directional systems were expensive and bulky. Although a number of these 
systems were relatively secure some had practical constraints and generally lacked 
an acceptable means of handling lost codes, ie. codes transmitted outside the range 
of the related receiver. This inevitably created a "backdoor" that resulted in a breach 
of security. 

[0010] Soum (US Patent No. 5107258), Yoshizawa (European Application number 
88116675.5) and Bruwer et al (US Patent No. 5517187) show systems addressing 
various problems associated with uni-directional security encoder/decoder systems. 
However, as has been pointed out, security systems are dynamic and new types of 
attacks have evolved and shortcomings in such systems have surfaced. 



[0011]Soum's system has an incrementing counter and each transmission is based 
on a new counter value. The counter value together with other Information Is 
encrypted using an irreversible algorithm and secret information. The count is 
transmitted In clear text together with the encrypted data word. The receiver needs 
5 to verify that the encrypted value corresponds to an open value. As such a lost 
code or synchronisation does not present a problem. 

[0012] In the system taught by Bruwer et al use is made of a counter that changes 
with each activation. Using a secret key or identification number the count value is 
encrypted together with other data by means of an algorithm that has a related 
10 decoding algorithm at the receiver. At the receiver end the encrypted code word is 
decrypted to yield the counter value. By subtracting the previous valid received code 
word counter value from the latest counter value the number of lost codes can be 
determined. 

[0013] In the aforementioned references the number of lost codes can determine 
15 some further action but, more importantly, it can be ascertained whether the code 
received is indeed a new code and not a replay of an old code that could have been 
recorded. 

[0014] The aforementioned systems do however display the following weaknesses 
irrespective of the quality of the encryption algorithm which Is used to secure the 
20 data: 

[0015] (a) off-site recorded reolav attack: in this scenario the transmitter is 
activated out of range from the relevant receiver. The code Is then recorded and can 
through a replay be used to activate (open) a garage door opener (GDO) or car door 
etc. This can be done even though the legal key is still with the owner and away 
25 from the receiver. Hours may pass since the recording was made. Of course, the 
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next transmission from the authentic key received by the decoder will nullify the 
recorded code. 

[0016] This attack can be more dangerous when, after the recording or recordings 
have been made, the legal key is damaged (not visibly but functionally) and therefore 
5 cannot nullify the recorded transmission by providing the receiver with a more recent 
code. 

[0017] Unless the user erases that particular transmitter (or key), the attacker can 
use the recorded codes or codes for an extended period (months or years) to gain 
unauthorised access. It is known that the average user seldomly perform such tasks 
10 diligently. 

[0018] The attack does need physical access to the legal key and it can be argued 
that the attack is irrelevant, which is probably true for most situations. However, it is 
still as easy as, or easier than, stealing a mechanical key, having a duplicate cut and 
then replacing the original to avoid suspicion; 

15 [0019] (b) double rec ording, block and replay: this attack requires a little more 
skill but is certainly possible for most people with electronic knowledge. The attack 
is very relevant to single button GDO's. When a user activates a transmitter to close 
a door, the attacker records the transmitted code word but at the same time blocks 
the GDO receiver from receiving the particular code word. This can be done by 

20 selective jamming of the transmission words. 

[0020] The user would typically attempt another transmission. The attacker again 
records and blocks. When the transmission terminates the attacker replays the first 
code word captured. The GDO receives this and closes. 
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[0021] If the user now leaves the attacker will have captured a code word that would 
for the time being (until the legal user returns some hours or days later) be capable 
of activating that particular GDO; 

r00221 unsecured com mand bits: the system proposed by Soum transmits its 
5 commands unsecured. This would make it easy for an attacker to change one type 
of command (set alarm) into another (deactivate). Using this technique, the double 
recording block and replay attack can also be used on multi-button transmitter 
systems; and 

[0023] (d) fast stepping: wrapping in a short time. This is probably the worst 
10 problem since very little technology is required for this attack. The attacker steps the 
transmission by activating the transmitter a number of times, say 100, and then 
makes a few recordings of transmissions following. The attacker then activates the 
transmitter until it wraps around and stops it at the same count it was before it was 
originally started. The user is nothing the wiser but the attacker will have some 
15 future codes to use in an attack that may be at any time over the next extended 
period of time. 

[0024] Non-security related shortcomings are: 

[0025] (a) if a legal key is used for more than one decoder/application, the 
counter can be advanced many times between activation in the least used decoder. 
20 This can lead to wider window requirements which, although lowering the security 
level, is more of a practical operational problem. 

[0026] (b) the fact that the counter value is transmitted in the clear as well, eg. as 
in Soum's technique, makes the code word longer. This has transmission energy 
and noise susceptibility implications. 

25 
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[0027] As can be seen from the preceding discussion the systems presented by 
Bruwer et al and Soum, although vastly improved over previous fixed code systems, 
still have some areas open to improvement. This will become imperative as the 
technology available to attackers becomes more advanced. The incentive for an 
5 attacker also becomes more attractive as this type of system is used to protect more 
and more valuable property. 

[0028] The system presented by Yoshlzawa is time based with a timer replacing the 
incrementing counter used by Soum and Bruwer et al to ensure codes that change 
with every transmission. This approach holds major advantages for security. 
10 However, the system as presented by Yoshizawa has serious shortcomings when 
considered for wide ranging implementation in products like remote keyless entry 
(RKE) for vehicles, remote controls for gates and garage door openers (GDO's) or 
other access control applications with security requirements. 

[0029] Yoshizawa proposes a system in which transmitter and receiver timers are 
15 started at the same time to synchronise the timers. This procedure would be too 
complicated for a large percentage of users. When more than one transmitter must 
operate a single receiver the position becomes much worse. In fact, when all 
transmitters are not present at the same time, this approach is impossible (col. 3 - 
lines 36-41). This is impractical for most applications. 
20 [0030] Yoshizawa recognises the time difference which will occur due to natural drift 
between the timers but only addresses this problem by increasing the window of time 
for accepting transmissions and giving a warning when the time difference reaches a 
certain limit which is less than the limit beyond which the receiver cannot be 
controlled. 

25 
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[0031] In a further embodiment a code setting action Is required (col. 5 - lines 16- 
21). A wrist watch with a display and a keyboard (10-key) is shown in an example. 
In this embodiment the receiver can accept direct transmissions to set a number of 
timers. In this case keyboards on the transmitter and receiver are required. 
5 [0032] The transmitter/receiver time displays also guide the user to adjust the time 
when a discrepancy is noticed. A system like this requires displays, keyboards and 
user intervention, and may be unacceptable in a large number of applications due to 
cost, size and user transparency ease-of-use requirements. 

[0033] The Yoshizawa system Is intended for applications in which a few "illegal 

^" 10 entries", which may be achieved in a relative short period (col. 9 - lines 45-48), are 
I not regarded as a problem. However, in general security applications such an event 

J would be unacceptable. 

1 [0034] Yoshizawa does not present a solution for the very real problem where the 

receiver or transmitter timer loses power (dead battery) and as such loses track of 
15 time relative to other timers in the system. It must be deduced that a complete re- 
learn will have to be performed. This would certainly not be acceptable in the 
general marketplace. 
SUMMARY OF THE INVENTION 

[0035] The invention provides a method of securely transferring data from a 
20 transmitter to a receiver which includes the steps of: 

(a) at the transmitter encrypting data which at least in part is based on timer 
information at the transmitter, to form a transmission word, 

(b) transmitting the transmission word to the receiver, 

(c) at the receiver decrypting the transmission word, 

25 (d) validating the transmission word by comparing the transmitted timer 
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information to predetermined information at the receiver; and 
(e) when a valid transmission word is received adjusting the said predetermined 
information. 

[0036] In one fomi of the invention the said predetermined information is a window 
5 size assigned to the receiver with reference to a previously received value and timer 
Information at the transmitter is generated by a first timer which is operated to ensure 
that the timer infomnation does not fall outside the said window. 
[0037] In another form of the invention the said predetermined information is timer 
Information generated at the receiver. 
10 [0038] The data which is encrypted may be compiled Into a data word which is 
encrypted to form the transmission word. 

[0039] The data word may additionally include at least one of the following: identity 
information pertaining to the transmitter; command information; utility information; 
fixed code information; and user derived information. 

15 [0040] The method may include the step of keeping the transmitter and receiver in 
synchronism using a cold boot counter which is changed each time the transmitter is 
powered up or comes out of reset. The count value of the cold boot counter may be 
used to Influence a key or algorithm at the transmitter and the count value is not 
necessarily part of the data word which is encrypted. 

20 [0041] The count value of the cold boot counter may be transmitted to the receiver in 
the clear. 

[0042] At least part of a word in which the count value of the cold boot counter is 
embodied may be used to designate a possible optional status. 
[0043] As each transmission word (ie. including the encoded or encrypted data word) 
25 transmitted from the transmitter is based on a new value from the timer at the 
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transmitter, it follows that the transmission words may differ from each other even 
though the transmission words result from a single activation of the transmitter . This 
approach may however not always be desirable and according to a variation of the 
invention a new transmission word is formed only with every new activation of the 
5 transmitter or after an extended period of transmission activation. 

[0044] According to a preferred aspect of the invention the encoder at the transmitter 
has a user-derived changeable portion of its key. This portion of the key can be 
varied through one or more inputs to the transmitter encoder made in any 
appropriate way, for example through the medium of DIP switches, a button 

5^' 10 operation procedure or the like. Added security is obtained since the user derived 
information cannot be known to the manufacturer. 

f [0045] According to a preferred aspect of the invention the receiver decoder has a 

Z learn mode which enables the decoder to leam a new authorised encoder. Upon 

completion of the learn action the decoder is able to recognise transmissions from 
15 the now-learned encoder. Since a key needs to be derived from data transferred 

, from the encoder to the decoder during the learning process, for example from the 

serial number, seed, and user-derived key information, the method of the invention 
provides that this information may be stored and that the key may be derived only 
during the process of receiving and interpreting commands. 
20 [0046] Preferably the method of the invention includes the step, during the phase 
that the decoder learns infonnatlon from a transmitter, of storing the learning 
information in a first-in-first-out (FIFO) structure. 

[0047] During the learning process a relationship is established between the timer 
value of the transmitter and the timer value of the receiver. The invention provides 
25 that the difference between the two timer values may be determined and stored at 
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the receiver, updated when necessary, and the difference may be compared to the 
difference resulting with each subsequent transmission and updated when 
necessary. 

[0048] In order to keep the timer (or clock) at the transmitter (encoder) in 
5 synchronism with the timer (or clock) at the receiver (decoder) the invention 
provides, according to a preferred aspect, that the encoder timer at its slowest 
variance (due to drift or any other factors) Is faster than the decoder timer at its 
fastest variance (due to drift or other factors). 

[0049] The invention may provide that with each valid reception of a transmission 
10 word the decoder recalibrates the relationship between the encoder and decoder 
timers for the specific encoder (referred to as the Tr value). In other words the 

J previous Tr value is replaced by the latest Tr value which reflects the exact 

7 

? relationship between the timers of the specific encoder and the decoder. 

[0050] According to a further aspect of the invention the method provides an auto- 

l 1 5 synchronisation window and a minimum or maximum window. 

'~j [0051] The auto-synchronisation window (Wa) sets a time limit boundary for drift 
which is not regarded as a problem. This window may be a fixed value but 
preferably is related to operating time of the transmitter and receiver and, 
consequently, will increase with the passage of time. The size of the window may be 
20 a function of the elapsed or operating time but, nonetheless, may be capped to an 
acceptable period. 

[0052] If the encoder timer value lies outside a re-synchronisation window (Wr) then 
the method of the invention may inhibit the reception of further transmissions from 
the encoder and enforce a re-learn action to reset the encoder/decoder relationship. 
25 Altematlvely the method may allow for at least one of the following steps in the 
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case where the encoder timer is fast or the value of the encoder timer lies outside 
the Wa and Wr windows: 

(a) resynchronise from an "open/safe" state. This is equivalent to adjusting the 
combination of a safe access code when it is open; or 
5 (b) the encoder may be brought into physical contact with the decoder by means 
of an electrical conductor or connector. This step may be required before further 
access can be granted. 

[0053] By using a physical electrical connector to transfer resynchronising signals 
between the encoder and the decoder it is possible to allow the decoder to control 

10 activation buttons or inputs on the encoder to create a quasi bi-directional system. 
Activations can be executed in such a way that the probability of codes, which do not 
originate from the authentic encoder, being presented to the decoder, is very low. 
[0054] For example by physically connecting the encoder to the decoder it is possible 
to activate the encoder at a precise period and start the timer at the encoder. The 

15 decoder then randomly activates other inputs at the encoder which influence the 
transmission words from the encoder by using command bits in the data word. The 
decoder verifies that the words were constructed at the precise time with the correct 
command input information. By ensuring that the activation sequence is such that 
the encoder timer is used the pre-recording of multiple commands can be prevented 

20 thus lowering the probability of a successful attack. 

[0055] In a specific embodiment a timer based transmitter (or key) can be designed 
to work with both non-timer and timer based decoders (receivers). This is important 
in a situation wherein a dual system may be required for a move in technology from 
counter-based to timer-based techniques but where compatibility with existing 

25 systems in the field is essential. 
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[0056] The timer in a transmitter may count normally upon activation when batteries 
are inserted. When the transmitter is "learnt" to a receiver, the decoder accepts any 
value. That is, the decoder does not distinguish between a counter or a timer but 
simply accepts a value. This alleviates any requirement for starting the systems 
5 together as per the prior art. 

[0057] The transmitter will then keep the timer active only for a period which would 
keep the timer value within the automatic re-synchronisation window of the old count 
(on button activation) based system. 

[0058] When the timer reaches the point at which the timer value will go out of the 
10 window, the timer stops. This means that upon the next transmitter activation the 
timer value used, will be viewed by the "old" decoder as a counter that is still within 
the limits of the auto re-synchronisation window and will be accepted without a 
problem. 

[0059] In another embodiment the transmitter will set a flag when its timer moves 
15 outside the auto re-synchronisation window. Upon the next transmission the 
transmitter will automatically perform the actions required for re-synchronisation 
when the counter is outside the window, for example doing two transmissions with 
timer values in close proximity of each other. 

[0060] In order to handle situations wherein battery (power) failures occur, the timer 
20 value can be stored in non-volatile memory every time a transmission occurs. Upon 
reset the stored value will be used as a basis for the restart. 

[0061] Preferably, in step (e), the said predetermined information is adjusted to 
compensate for drift between the transmitter timer and the receiver timer or for any 
other discrepancy or variation at the receiver. 

25 
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[0062] The invention also provides apparatus for transferring data which includes a 
transmitter and a receiver and wherein the transmitter Includes a timer and an 
encryption unit for encrypting data which at least in part is based on timer information 
from the transmitter timer thereby to form a transmission word, and the receiver 
5 includes a receiver timer, a receiver unit for receiving the encrypted transmission 
word, a decryption unit for decrypting the received transmission word to extract, at 
least, the said timer Information from the transmitter, and a comparator unit for 
comparing decrypted transmitter timer infonnation to timer infonnation from the 
receiver timer to determine the validity of the transmission word. The apparatus 
10 preferably Includes a unit for adjusting the receiver timer infomiatlon when a valid 
transmission word is received. 

[0063] The Invention also extends to a transmitter which includes a timer and an 
encryption unit for encrypting data which at least in part is based on timer information 
from the transmitter timer thereby to form a transmission word and wherein the timer 

1 5 is permitted to run only for a limited period after each activation of the transmitter. 
[0064] The invention also provides a transmitter which includes a timer and an 
encryption unit for encrypting data which at least in part is based on timer infonnation 
from the transmitter timer thereby to form a transmission word and wherein, when 
the timer runs beyond a predetermined limit, the transmitter, upon activation, 

20 transmits more than one transmission value. 
RRIFF DESCRIPTION OF THE DRAWINGS 

[0065] The invention is further described by way of examples with reference to the 
accompanying drawings in which: 

Figure 1 is a block diagram representation of an encoder used in a data transferring 
25 system according to the invention, 
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Figure 2 is a memory map of the encoder shown in Figure 1 , 

Figure 3 is a block diagram representation of a decoder for use with the encoder of 
Figure 1 , 

Figure 4 is a non-volatile memory map of the decoder of Figure 3, 
5 Figure 4a Is a volatile memory map of the decoder of Figure 3, 

Figures 5 and 6 respectively represent data and transmission words originating at 
the transmitter, 

Figure 7 depicts memory locations for a learning encoder, 
Figure 8 illustrates a first-in-first-out technique for learning a second encoder, 
10 Figure 9 (which is presented in two parts marked Figure 9a and Figure 9b 
respectively) is a flow diagram representation illustrating normal operation of the 
encoder, 

Figure 10a Is a flow diagram of an encryption process, 
Figure 10b illustrates the action of an encoding algorithm, 
1 5 Figure 1 1 is a flow diagram of steps during normal operation of a decoder, 

Figure 12 is a flow diagram representation of a learn operation at the decoder, and 
Figure 13 illustrates the setting of used derived information at the encoder. 
nF.qORIPTION OF PREF FRRED EMBODIMENT 

[0066] Figure 1 is a block diagram representation of an encoder 10 which is used in 
20 a transmitter for transmitting data, in a secure form, according to the invention, over 
a radio frequency, infrared, or other medium. 

[0067] The encoder can be implemented as an integrated circuit with its various 
components being part of this circuit or provided as discrete components. 
[0068] The encoder 10 has non-volatile memory 12, a control unit or processor 14, 
25 an interface or input module 16 which receives data from input sources 18 such 
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as switches or push buttons, an oscillator 20, a timer 22 and a voltage reference 
module 24. 

[0069] Infomriation pertaining to the identity of the encoder is stored in the non- 
volatile memory 12. 

5 [0070] The timer 22 runs continuously and is connected to the oscillator 20, or to a 
crystal, to give a timing reference. The timer 22 changes at regular intervals to 
reflect time irrespective of whether the encoder is activated for transmission. The 
time measure can be in minutes or seconds but may be any regular period. 
[0071] The encoder is controlled by a user activating one or more of the inputs 18 
10 and the resulting signals are interfaced to the control module 14 which interprets the 
input and causes corresponding operation of the encoder. 

[0072] Figure 5 illustrates an example of a data word 28 produced in the encoder. In 
this example the data word Includes timer information 30 derived from the timer 22, 
command Information 32 which is produced by one or more of the inputs 18, a serial 

15 number 34, or a portion thereof, which relates to the identity of the encoder, fixed 
code or user derived infomiation 36, and utility infomnation 38 which pertains to 
operational parameters of the encoder. The timer information 30 is essential to 
produce variance in the data word 28 in order to prevent replay attacks. The length 
of the timer and its resolution reflect a balance between cost, security, and practical 

20 implementation factors. For example the timer may be a 24-bit device which 
increments every 10 seconds. Due to the fact that the timer changes every 10 
seconds a transmission value recorded away from the receiver will soon be invalid 
because the decoder will be able to determine that the timer value is out of date. 
[0073] The oscillator 20 in Figure 1 is preferably completely on-chip failing which the 

25 oscillating range must be restricted. As such the oscillator cannot be fast 
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forwarded to achieve the same effect as in a "fast stepping" attack, or purely to make 
up time that can be used to record away from the receiver and then use the "extra" 
time to go back to the receiver. 

[0074] One of the major problems of a time based system is that power 40 (see 
5 Figure 1), whether from a battery source or otherwise, may be lost. If this happens 
the encoder immediately loses its relative time compared to other encoders and 
decoders which form part of the security system in question. The time may be saved 
into non-volatile memory at regular intervals so that upon re-application of power to 
the encoder the timer can proceed from where it left off. It will, however, still be out 

1 0 of synchronisation by approximately the period that it was without power. 

[0075] Continuously writing to memory requires "waking up" at regular intervals and 
over several years of usage the writing may be extensive. The waking up and 
writing operations consume meaningful quantities of energy which is not desirable in 
most applications. These operations may also limit the options on non-volatile 

15 memory due to the high number of read/write cycles and thus the quality of non- 
volatile memory which is required. 

[0076] Another option is to save the time with each transmission. Neither of these 
possibilities is however without drawbacks from the security point of view. The 
invention, as an alternative to the aforegoing approaches, makes use of a cold boot 
20 counter (CBC) 46 as is shown in the memory map 48 of Figure 2. The cold boot 
counter value is incremented or changed each time the encoder is powered up or 
comes out of reset. The cold boot counter can also be changed when the timer 
overflows after an extended period of operation. 

[0077] The use of the cold boot counter holds several advantages in practice: 
25 (a) the encoder is generally cheaper, incrementing the timer in volatile memory 



16 



(RAM) at lower voltages is less costly than storing a value in non-volatile memory 
(EEPROM) at very low voltages; 

(b) fewer writes to non-volatile memory are required; 

(c) the risk of writing errors is reduced; 

5 (d) since the cold boot counter is changed only at the time of powering up or 
reset, time constraints are much relaxed. It may however be desirable from a 
security perspective to increase the time constraints from seconds to minutes; and 
(e) the power requirement is reduced. 

[0078] It is noted that it is important that the cold boot counter value changes in a 
10 constant direction (up or down) in order to detennine new and old transmissions 
(possible replays). 

[0079] As is shown in Figure 2 the memory map 48 at the encoder includes an 
identification number or key 50, the cold boot counter (CBC) value 46, a serial 
number 52, a configuration word 54, a seed 56 and user-derived key information 58. 

1 5 The cold boot counter value can be used to influence the key or the algorithm at the 
encoder and does not necessarily form part of the data word 28 to be encrypted. It 
is however proposed that the cold boot counter value is transmitted to the 
receiver/decoder in the clear. This may not happen with every word but can for 
example only occur in an extended transmission, say of at least 15 seconds, or for 

20 the first hour after a power-up event. The CBC value may also be transmitted 
partially with successive transmission words. 

[0080] Figure 6 illustrates a transmission word 70 which includes the cold boot 
counter value 46 (in the clear), command information 72, an encrypted version 74 of 
the data word 28, the serial number 34, a heading 74 and a cylic redundancy count 
25 (CRC) value 78. This word is transmitted to the decoder at which the word is 
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decrypted and data extracted therefrom is used, in a manner whicli Is described 
tiereinafter. 

[0081] According to one aspect of the invention a number of high end bits of the 
timer value are used for a high speed timer to count down for a short time period, 
5 say of the order of 10 seconds. This Is done immediately following a first 
transmission In a sequence of activations. One bit of the timer is used to designate 
an optional status bit to show what Is reflected in the timer 22. This high speed timer 
allows easy access and better time resolution in the period after a transmission has 
been activated and helps a decoder make time-based activation decisions. For 
10 example a second transmission activation within three seconds of a first activation 
may be a command to unlock all doors in a vehicle and not only the driver's door. 
The decoder need not even receive the first transmission. 

[0082] As the timer 22 runs each transmission word from a single activation of the 
encoder may be based on the new timer value and may as such differ from a 
15 preceding word. This approach may however not always be desirable and according 
to a variation of the invention a new transmission word may be formed with every 
new activation of the encoder or after an extended period of transmission activation, 
say in excess of 5 seconds. 

[0083] Figure 3 Is a block diagram representation of a decoder 80. The decoder 
20 includes a control unit or processor 82, an on-board oscillator 84, a timer 86, a 
decoding and key-generating algorithm 88 which is stored in non-volatile memory, a 
memory module 90, a reset and voltage reference 92, and an output module 94 
which acts as an interface to output devices 96 eg. LED's or the like. Data 98 may 
be transmitted to the control unit during a normal transmission whereas learning 

25 
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input 100 may be instructed to the control unit to enter a learning mode. Preferably 
the oscillator is controlled by a crystal 102. 

[0084] Figure 4 is a decoder memory map 104 of information held in the non-volatile 
memory 90. The map includes a generation key 106 and a plurality of sets of data 
5 108(1), 108(2) ... etc. resulting from successive transmissions from respective 
transmitters/encoders. Each transmission includes the respective cold boot counter 
value, the seed and serial number, the user identification number and the 
configuration word referred to in connection with Figure 2. The decoder, in volatile 
memory, (Figure 4(a)), may also include infonnation about the relationship of each 
1 0 encoder timer with the decoder timer (Tr). 
LEARNING 

[0085] The decoder 80 has a learn mode in which It can "learn" a new authorised 
encoder. Upon completion of the learn action the decoder is able to recognise 
transmissions from the now learned encoder. The learning process is, in general 

15 terms, known in the art. However it is proposed that each encoder has a user- 
derived changeable portion of its key 58 (see Figure 2), which is a portion of the key 
that can be changed or influenced by the user and which is not known to the 
manufacturer. This has a number of security benefits. The user-derived key 
information can be detemiined through inputs 18 to the encoder, eg. DIP switches or 

20 through a button operation procedure. An example is the time period between a first 
power-up action and the instance at which a button is pressed. The user-derived 
information 36 may also be inserted into the data word 28 and both methods will 
cause a change in the transmission word (70) values and sequence. 
[0086] Since a key needs to be derived from data transferred from the encoder to the 

25 decoder during the learning process (for example the serial number, seed and the 
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user-derived key information) it falls within the scope of the invention to store this 
information and to derive the key only during the process of receiving and 
interpreting commands. This does have the drawback of needing extra processing 
at the time of receiving a command but saves costs as non-volatile memory to store 
5 the keys is not required. When learning information from a transmitter, during the 
learn mode, this information is stored in a fIrst-in-first-out (FIFO) stack structure. 
[0087] As can be seen from Figures 7 and 8 each new encoder is learned into the 
same position. Prior thereto ail other positions have been programmed into the next 
memory location, ovenwrlting the information that was there before. Clearly the 
10 previous value that was in position "n" (Figure 8) will be lost - hence the FIFO 
J designation. 

? [0088] During the learning process a relationship (Tr) is established between the 

- timer value (Te) of the encoder and the timer value (Td) of the decoder. 

[0089] For example, if at the time of learning, Te = 120 and Td =1243, the difference, 
I 15 Tr, between the two values, which is 1123, can be stored. If it is accepted that the 
'Z decoder and encoder timers are perfectly in synchronism then at the time of the next 

transmission when Td = 1574 the received Te value must correspond to 1574 - 1 123 

= 451 . It is important that the Tr value is stored for each learned encoder. 

SYNCHRONISATION 

20 [0090] As the encoder and decoder timers (22 and 86 respectively) will inevitably 
exhibit drift between them in all but the most expensive systems it is important to 
accommodate such drift without undue sacrifices to security and with as little 
requirement for user intervention as possible. This also holds true for the handling of 
a power failure at the encoder or decoder. 

25 
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[0091] According to a preferred aspect of the invention the timers 22 and 86 are 
designed so that the encoder timer is always faster than the decoder timer. The 
design is such that even with the encoder timer at its slowest variance and the 
decoder timer at Its fastest variance the encoder timer is the faster of the two. 
5 [0092] With each valid reception the decoder recalibrates the Tr value for the specific 
encoder and the previous Tr value is replaced with the new Tr value which reflects 
the exact and latest relationship between the encoder and decoder timers (22 and 
86). As such even if there is drift of (say) 1 minute per day and a 5 minute window is 
allowed for a valid transmission, a system which is used on a regular basis does not 

10 drift too far because with each use the previous drift is calibrated out. For example, 
a system in a car which is used twice a day (evenly spaced) will, based on the 
preceding assumptions, always be within about 0,5 minutes accuracy. 
[0093] Due to security considerations a reception under conditions in which Te is 
further advanced, with reference to Td, is less of a problem than a slow Te. The 

15 latter may be an attempted replay or a transmission recorded out of range from the 
decoder and then taken to the decoder (hence the timer loss) and replayed. 
[0094] Production offsets (le. drift between the timers which Is constant and which 
does not change over time) can also be calibrated out with a coefficient. For 
example when an alarm system is installed in a controlled environment (regulated 

20 temperature and voltage), two transmissions with a reasonable time period between 
them (of the order of several minutes) can be used to trim out such manufacturing 
offsets. If it is known that under controlled voltage and temperature conditions the 
normal drift is 1%, but it is found by measuring the drift between two successive 
transmissions that the drift is in fact 2%, then the difference can in future always be 
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multiplied by a factor (101/102). If the drift on the other hand is -1% then a factor 
(101/99) is used to adjust the drift. 

[00951 The invention allows two types of forward windows to be accommodated, 
namely an auto-synchronisation window Wa and a re-synchronisation window Wr. 
5 [0096] The auto-synchronisation window sets a time limit boundary for drift (Te 
greater than Td) which is not regarded as a problem. Security requirements dictate 
this value should be as small as possible but, from a practical point of view, this 
should not enforce additional actions on a user to such an extent that the system 
becomes cumbersome or user-unacceptable. The auto-synchronisation window 

10 could be a fixed value but in a preferred embodiment is represented by a factor of, 
say, 3% of usage time. In the latter case the window grows larger over time but is a 
more accurate representation of the drift between the counters. In the prior art which 
is embodied in Bruwer et al and Soum the counters represented a number of 
activations which are unrelated in time. In the present invention however the auto- 

1 5 synchronisation window is not related to the number of activations and is purely a 
function of the relative drift between the timers over the time elapsed since a 
previous valid reception. This is the case since Tr was last calibirated at the 
minimum or at the time of the previous valid reception. Note that in Yoshizawa the 
window has to cover time elapsed since the encoder was first connected with the 

20 decoder. This is quite a severe impediment. 

[0097] The Wa type of window which can be accommodated by the system can have 
a minimum and/or maximum value. This window can be specified even though a 
factor of the elapsed time is used for the determination of the window size. This has 
the advantage that in a system which is used on a regular basis the Wa window is 

25 
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quite small but even if the system is not used for a long time, say in excess of a year, 
the size of the window Wa is kept to an acceptable period of, say, 10 minutes. 
[0098] For example for a 0,1% Wa factor and 5 second minimum and 10 minute 
maximum caps the following occur: 
5 Time since p revious valid code Wa size 

10 minutes 5 seconds 

5 hours (600 min) 36 seconds 

5 days 7,2 minutes 

10 days 10 minutes 

10 1 year 10 minutes 

[0099] Should the Te value be faster so that it falls beyond Wa in terms of security it 
is desirable to perform further security checks. A further window called a re- 
synchronisation window (Wr) can be used and this window will require some further 
security checks that may not be too stringent. 

15 [00100] One such security check requires a further transmission in order to 
verify that the timing information correlates with the expected value with reference to 
that of the previous transmission which fell outside Wa but inside Wr. In some 
applications this check would suffice and, if the encoder timing information passes 
this test, the decoder accepts the command and also re-synchronises the Tr value to 

20 remove the drift which has occurred. 

[00101] If the Te value is beyond Wr the decoder does not accept 
transmissions from that encoder and enforces a re-leam or other action as is 
described hereinafter, which totally resets the encoder/decoder relationship. 
[00102] With a Te value which is slow with reference to the Td value the 

25 security constraints required are much tighter. With correct design there is no 
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reason why the Te value should fall behind the expected value. It must be 
recognised however that any increment beyond the value previously received, even 
if slower with respect to the expected value, still yields better security than "activation 
count" based systems such as those described in the Bruwer et al and Soum. 
5 Yoshizawa on the other hand treats slow and fast windows in the same way. 

[00103] Depending on the security requirements various options can be 
designed into the system to "double check" the authenticity of the encoder. For 
example, if the Te value is 30 seconds fast then the decoder can check for a new 
value 30 seconds later. A valid new code would mean that the encoder Is present 

1 0 and therefore authentic. 

[00104] However with a sound design and a guarantee that Te is faster than 
Td, rather than slower, the reception of a slow Te raises serious security concerns. 
[00105] It is possible to re-synchronise an encoder with a slow Te, or a Te 
falling outside the Wa and Wr windows, in one of three different ways described 

15 hereinafter: 

(A) Re-svnchron ise from an "ooen/safe" state. 

[00106] This is equivalent to adjusting the combination of a safe access code 
when it is open. As such another legal or approved mechanism must be used to put 
the system in an "open" state. This can be another encoder, a mechanical key, an 
20 electronic token or the like. Once in an "open" mode the Tr value can automatically 
adjust. 

(B) Phvsical contact between the enco der and decoder can be established by 
means of an electric c onnector. 

[00107] This can be a requirement before further access is granted. Physical 
25 contact may be established through an electrical connector situated on the 
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outside of a security perimeter which is protected by an access control system linked 
to the encoder/decoder. 

[00108] For example if the system controls a garage door opener, the electrical 
connector can be in a house or an outer side of the house. On the other hand if the 

5 security system is used in connection with a vehicle, the connector may be on an 
outer side of the vehicle or some place which is accessible only with a mechanical 
key, eg. inside the trunk or boot of the vehicle. 

[00109] By using a physical electrical connector to transfer electrical signals the 
decoder can control activation buttons to create a quasi bi-directional system. 

10 Electrical contacts to the activation inputs of the encoder allow the activations to be 
executed in such a way that the probability of codes, which do not originate from the 
authentic encoder, being presented to the decoder is very low. This probability can 
be statistically controlled by suitable design. In other words by making the 
communication via the electrical contacts more complex or expanded, the probability 

15 of a successful attack can be lowered. 

[001 10] In a preferred embodiment the high speed timer and repeat (activation) 
counter play a major role. Upon insertion in the connector the decoder activates the 
encoder. This first transmission starts the high speed timer and the decoder then 
randomly activates other buttons which influence the transmission words from the 

20 encoder via the command bits in the data word. The decoder verifies that the words 
have been constructed at the precise time with the correct command button 
Infomnation. By making sure the activation sequence is such that the high speed 
timer is used or that the normal timer would show, the pre-recording of multiple 
commands can be prevented, thereby lowering the probability of a successful attack. 

25 
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[00111] In another embodiment the sequence can also be checked via the 
repeat activation counter which counts the number of activations in a defined period 
after a first activation. Again, this can prevent the pre-recording of multiple 
activations in order to have a replay response available to the decoder activations. 
5 [00112] The same mechanism can be used via feed back to a user but will 
probably not be acceptable for the average user. An example is a display panel 
indicating the sequence of buttons that must be pressed. 
(C) Bi-directiona l communication. 

[00113] Full bi-directional communications may be used. If however bi- 
10 directional communication facilities are available then these facilities should be 
considered for more extensive use as they can enhance security when implemented 
correctly. A situation can however be foreseen in which communication in one 
direction will be of limited range. For example, the encoder to decoder medium may 
be RF whilst the decoder communicates with the encoder via optical, transponder or 
1 5 hard wiring means due to cost or other considerations. 

[001 14] In an example of an application using the principles of the invention an 
IR LED may be used to provide the communication medium from the decoder to the 
encoder. The encoder is part of a RF key fob. The encoder monitors an optical 
receiver (PIN diode) after it has been activated and has transmitted a code word. If 
20 the decoder receives a code from the encoder with an unacceptable Te, it 
communicates back to the encoder via the optical medium. If the key fob is held in 
the optical path, (because the user notices that the decoder does not read), it will 
receive the decoder data and the encoder/decoder can proceed with a bi-directional 
verification process. 

25 
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[00115] It must be mentioned that a physical connector can also solve the 
problem of a dead encoder battery by providing power, whereas the optical system 
cannot. 

[00116] If the authenticity of the encoder is established via any of these 
5 methods, the Tr value is automatically adjusted to re-synchronise Te and Td by 
removing any drift that may have caused the problem. 
ENCODER OPERATION 

[00117] An example of an encoder operational life cycle is described with 
reference to Figure 9. 

10 [00118] Upon a power-up sequence or when a reset occurs (210) a number of 
functions take place to reset the integrated circuit which embodies the encoder. In 
essence the Integrated circuit Is put into a well-defined state to ensure that Its 
function is predetermined upon coming out of reset. For example memories are 
cleared, and pointers and program counters are set to defined positions. 

15 [00119] The encoder now increments (212) the cold boot counter (CBC) value. 
It is important that redundancy or error correction is used in this step to prevent the 
CBC value from being erased or scrambled due to writing en-ors or the like. As such 
checks should also be done to verify that the voltage supplied to the circuit is 
sufficient to ensure successful writing into the non-volatile memory. 

20 [00120] Once the CBC value has been incremented the encoder moves Into 
the cycle In which it will spend most of Its life. If the timer Is to be Incremented (216), 
and this takes place at regular intervals of, say, 10 seconds, then the timer count is 
advanced (218). A further check (220) is done to verify that the timer has not 
reached its limit and is about to overflow. This however Is a rare occurrence. 

25 
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[00121] The inputs 18 (see Figure 1) are monitored (222) to check if the 
encoder has been activated. If no inputs are active the cycle repeats itself endlessly. 
[00122] Upon detecting active inputs, the inputs are debounced and read (224). 
If the inputs are valid (226) the timer value is read and the data word is constructed 
5 (228). It has been explained in connection with Figure 5 that the data word consist 
of several elements which are put together to prepare the encrypted data word 74 
(see Figure 6). 

[00123] If the inputs are not valid (229) then the earlier cycle steps are 
repeated. 

10 [00124] After reading the timer the controller checks if the high speed timer 
(HST) is already running or if this transmission is actually the first transmission which 
has taken place after a period of inactivity (230). If the HST is not running it is 
started and the flag for the HST is set so that it is recognised that the HST is active 
(232). The subsequent transmissions will include the high speed timer count as part 

15 of the data word. 

[00125] The resulting data word is encrypted (234) and the result is used in the 
construction of the transmission word 70 (see Figure 6) in a step 236 (see Figure 
9b). Before the transmission word is transmitted over the medium in question (RF, 
IR or other) the inputs 18 are checked to verify that the same command is still active 

20 (238). If not the transmission is abandoned and the controller 14 returns to its 
waiting cycle (216, 222). 

[00126] If the command is still active the encoder starts to output the data of 
the transmission word so that it can be transmitted (240). Typically the encoder is 
responsible for the data rates. Although not shown the encoder can continuously 
25 check for a new input demanding that a new word should be formed immediately. 



28 



Under such circumstances the transmission can immediately be terminated in order 
to start preparing and transmitting the new transmission word. 
[00127] The controller can exchange some of the CBC bits that fonn part of the 
transmission word (242). For example if the CBC is 16 bits and only two bits at a 
5 time are being added to a transmission word then 8 consecutive words would be 
required to reconstruct the CBC counter at the receiver/decoder. This does not 
affect the security of the transmission but it does provide a convenient way of 
reducing the length of the transmission word. 

[00128] Thereafter the controller can return the operation (244) to the phase 
10 prior to the step 238. If however the system Is designed to start output of the HST 
after a certain elapsed time (say 5 seconds) it proceeds to a step 246 at which the 
HST count is read. A check is then performed to see if the command currently active 
has been active for at least 5 seconds (248). If a transmission word has not been 
previously constructed (250) then a check is done (252) to see If the same input 18 
15 Is still active. A recycle or return to earlier process steps takes place depending on 
the outcome of this test. 

[00129] If a transmission word has previously been constructed then the 
process synchronises the addition of a new HST count with the completion of an 
earlier transmission and a new data word is formed (254) and encrypted (256), and a 
20 new transmission word is constructed (258). The transmitter cycle then continues 
from immediately prior to step 238. At any time the process can be terminated when 
the inputs change or fall away (238 or 252). 

[00130] If the inputs change or are repeated within a short period, say from the 
start of the HST, the repeat counter increments with each new activation. Once the 
25 HST overflows the normal timer is incremented. If the HST works within the 
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same interval (say 10 seconds) this should prevent seamless timing. 
ENCODING 

[00131] An encoding example is described with reference to Figures 10a and 
10b. At the start of an encryption algorithm (300) all the initialisation of hardware 
5 and software is done. A specific key is read from non-volatile memory and the CBC 
count is obtained (302). The key is the key allocated to a specific encoder. If an 
encoder has multiple keys one of these is determined by means of a particular 
command. The key may be read 8 bits at a time. The data which is to be used in 
the encrypted data word, ie. the data word and the user derived information, is 

10 obtained (304) and the various elements are fed to the algorithm (306) to yield a 
scrambled data word (308) which is used in the transmission word. 
[00132] Figure 10b schematically depicts an encoding algorithm 310 operating 
on the data word and user derived information 312, and the key and the CBC count 
314, to yield the scrambled data word 74. 

15 [00133] It is to be noted that in the decoding process which is carried out at the 
receiver the decoder algorithm performs the reverse operation in that if the decoding 
algorithm is provided with the correct key and CBC count the decoding algorithm 
transfonns the scrambled data word 74 to yield the data word and the user derived 
information. 

20 [00134] An example of decoder operation is discussed with reference to Figure 
11. 

[00135] Upon reset (350) the decoder, in a step (352), scan its input (98 in 
Figure 3) for data received. If a test 354 shows that the data format is incorrect then 
the preceding cycle is repeated. Once a complete transmission word of the correct 
25 format has been received the decoder, in a step 356, does a cyclical redundancy 
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check (CRC) to verify that the transmission word was correctly received, and checks 
the serial number and the CBC portion of the transmission word. Thereafter in steps 
358 and 360 respectively the serial number and the CBC value are matched against 
corresponding values stored in non-volatile memory 90 (see Figure 3). 
5 [00136] If the CBC value is not matched against the stored value then a period 
of time elapses in which additional data is received and a new CBC value is 
constructed (step 362). The validation process is then repeated. 
[00137] After the validation process has successfully been completed the 
decoder reads the timer data Td (step 364) and then uses the serial number and 

10 other information stored during a learning process to calculate a decryption key (366) 
corresponding to the encoder that generated the particular transmission word. 
[00138] The decoder uses the decryption key together with the CBC value to 
perform a decryption process (368) on the scrambled part of the transmission word. 
It is to be noted that some commands may not require any security and in this event 

15 the decoder may interpret and activate the command after the step 360. However, 
since the only advantage would be that the command can be issued some 
milliseconds earlier this is not of particular significance. 

[00139] With the decrypted data word available the decoder perfomns a check 
to verify a match between the encoder user derived information and the decoder 
20 user derived information (370). A non-match forces a return to the scanning of the 
input for a valid transmission word (step 352). 

[00140] If the match is positive the more complex checking between the 
encoder and decoder timers is performed. In this example a re-learn is assumed if 
the re-synchronisation window Wr is exceeded or Te lags behind Td. Firstly the 
25 automatic synchronisation window is checked (372) and if the check is passed 
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then the command bits are interpreted and the outputs activated (374). The Tr value 
is updated to reflect the latest relationship between the encoder and decoder timers 
(376) and thereafter the process is repeated. 

[00141] If the step 372 shows that the difference between the encoder and 
5 decoder timers displays a Tr value falling outside the auto-synchronisation window 
Wa then the value is checked against the less rigid re-synchronisation window Wr 
(step 378). If Tr also falls outside of Wr then the received transmission word is 
abandoned as being invalid and the decoder returns to the scanning input step 352. 
[00142] If the timing difference Tr falls within Wr then the decoder prepares to 

10 receive another transmission word within a short time (say 10 or 20 seconds) and it 
then can use the HST data to confirm a second transmission (380) and verify the 
timing relationship (382). Because the time interval in question is particularly short 
no significant drift can occur. A check is done against Wa but, if necessary, a tighter 
check can be effected. If the test fails the decoder cancels the re-synchronisation 

15 process (384) and returns to step 352. 

[00143] If the timer test (382) is successful the Tr value Is adjusted (386) and 
the commands are interpreted and activated (390) whereafter the process retums to 
the stage 352. 

[00144] The preceding example does not cover the handling of the HST, repeat 
20 data, battery level indication, shift levels nor a situation in which the decoder loses or 
has lost power and therefore has lost timer information. 

[00145] Usually the decoder is more expensive and complex than the encoder. 
A single decoder is also typically required to work with multiple encoders. Power 
consumption is normally less constrained at the decoder, compared to the encoder. 
25 Due to these factors it is desirable to have the decoder timer include the HST 
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portion permanently. This may prove handy for comparisons at re-synchronisation 
actions or when second or third instructions are received within a short space of 
time. It is also important for handling a quasi-bidirectional synchronisation or 
authentication process as discussed earlier. 
5 [00146] The shift levels, battery level indications and repeat values all comprise 
information which may influence the outputs generated by the decoder. 
[00147] If the decoder should lose power then it would pass through the reset 
state (350) when power is restored. At this point a choice is made from a number of 
options. For example the time of every valid reception can be stored in non-volatile 

10 memory each time a valid word is received and successfully decoded. A flag can 
now be set to relax Wa and Wr for all encoders which have already been learnt, for 
one auto re-synchronisation action. A check is carried out that the encoder timer has 
increased beyond what was stored at the reception of the previous valid 
transmission word from the corresponding encoder. 

15 [00148] Another option is to enforce the change of the CBC value at the 
encoder or the re-synchronisation of the decoder Tr values by operating a transmitter 
while in the open state. 

[00149] In another variation the decoder can use a timer value from the next 
valid and previously learnt encoder activating it after the reset, to readjust its main 
20 timer. All Tr values (for other learnt encoders) would automatically come into play 
again. This can be done with some provision for en-or by adjusting the decoder for 
only 99% of the perceived lost time as can be derived from this single encoder timer. 
This is because it is far more difficult to handle encoders with timers lagging the 
decoder timer than for encoders with timers which lead the decoder timer. 

25 
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DECODER: LEARN MODE 

[00150] The decoder learn operation is discussed with reference to Figure 12. 
The decoder must be instructed to switch from normal operation to learning mode 
and typically this is done using an input switch 100 (see Figure 3). Once the 
5 activation of the input switch is detected (400), the switch is debounced (402) to 
confirm that the input is activated. The input for the learn mode can operate on an 
interrupt basis or it can be tested from time to time in the program flow during normal 
operation of the decoder. 

[00151] Once the learn mode has been confirmed (404) the decoder must 
10 receive sufficient transmission words to construct the CBC value that may not 
necessarily be completely included in every transmission word (406). If this process 
fails due to the transmission terminating before the complete CBC value has been 
received or due to the incorrect reception of code words, the learning process is 
abandoned (408) and the process returns to step 402 to verify that the leaming 
1 5 mode is still selected. The decoder timer is also read for reference. 

[00152] If sufficient infomiation is received to construct the CBC value (410) 
then the control unit 82 (see Figure 3) constructs the cold boot counter value and 
reads the timer data Td from the timer 86 (step 412). The control unit then 
calculates (step 414) the decryption key using the serial number, the CBC count and 
20 other information transferred via the transmission values. This key is used in the 
decryption process (414) to obtain the data word including the user derived 
information, commands and encoded timer information. 

[00153] In a step 416 the data is checked to see if it conforms to requirements. 
A further transmission a short time later may be required to verify the timer 
25 movement. Once accepted as a valid learn the relevant information is stored 
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into the decoder non-volatile memory 90. This includes the Tr value (the relationship 
between the encoder and decoder timers) and the Te of the last valid received data 
word. 

[001 54] The decoder may indicate (step 41 8) the status of the learning process 
5 on some indicator to the user, eg. an LED. The completion of the learning process 
of an encoder can also be indicated in the same way. 

[00155] This aforementioned process can be repeated to enable the learning of 
several encoders. The information from each encoder may be written to memory in 
a first-in, flrst-out sequence (FIFO) as Is shown in Figures 7 and 8. 

10 [00156] In the aforementioned sequence it is not possible to perform selective 
erasing of encoders. It is possible though to erase the oldest encoder by the 
addition of a new encoder, once the memory for learned encoders is full. A further 
command to erase all learn encoders may be implemented. 
ENCODER: SETTING "USER DERIVED INFORMATION" 

1 5 [001 57] Figure 1 3 illustrates process steps in setting user derived infomiation at 
the encoder 10. 

[00158] When the encoder is powered up (450) a check is performed on 
internal non-volatile memory 12 (see Figure 1) to determine if the user derived 
information ("UDI") has already been set. If not, the encoder can automatically enter 
20 a UDI setting mode. In a variation the encoder can check if a special set of inputs 
has been activated (452) to cause the encoder to enter the UDI setting mode. If not 
the encoder proceeds with normal operation (454). 

[00159] If special inputs are active (456) the encoder activates the high speed 
timer (HST) in a step (458). In a particular example the period for which the inputs 
25 are active is used to determine a value by stopping the HST changing at the time 
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the inputs change (460). The substantially random value in the HST can be read 
and used as a UDI value (462) to construct (464) a user defined information word 
which can then be stored (466) in the encoder non-volatile memory before 
proceeding with normal operation (454). 
5 [00160] The preceding description relates to a situation wherein the transmitter 
has a timer and the receiver has a timer. If an existing counter-based security 
system is to be upgraded to a timer-based security system then it is necessary to 
provide a dual capability so that the timer-based system can also be used with, and 
be compatible to, a counter-based system. 

10 [00161] To achieve this a timer-based transmitter is designed to work with a 
non-timer-based system (ie. counter-based), and with a timer-based system. 
[00162] The timer in the transmitter counts normally when powered up. When 
the transmitter is "leamt" to the receiver, the decoder at the receiver accepts any 
value which is assigned for the purpose or which otherwise is presented to the 

15 decoder. Hence the decoder does not distinguish between counter-based and timer- 
based information. The need to synchronise the starting of the transmitter and 
receiver is therefore done away with. 

[00163] The transmitter timer is then operated for a period which is limited or 
controlled to ensure that the timer information is kept within the automatic re- 
20 synchronisation window of the count-based system (ie. the earlier system which is to 
be upgraded). 

[00164] When the transmitter time value reaches a point at which it will go 
outside the window, the timer stops. Consequently, upon the next activation of the 
transmitter, the timer value which is used will be viewed by the previous (counter- 

25 
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based) system as a count value which is still within the limits of the automatic re- 
synchronisation window, and hence will be accepted. 

[00165] This procedure can be implemented until such time as a full timer- 
based system can be adopted. 
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